ipx 4.0.0-beta.1 → 4.0.0

package/dist/_chunks/node-fs.mjs

@@ -91,7 +91,7 @@ function parseArgs(arguments_, mappers) {
 	return mappers.map((v, index) => v(vargs[index]));
 }
 function getHandler(key) {
-	return handlers_exports[key];
+	return Object.hasOwn(handlers_exports, key) ? handlers_exports[key] : void 0;
 }
 function applyHandler(context, pipe, handler, argumentsString) {
 	const arguments_ = handler.args ? parseArgs(argumentsString, handler.args) : [];
@@ -187,21 +187,22 @@ function clampEdges(available, a, b) {
 	const clamp = (value) => value === void 0 ? void 0 : Math.floor(value * scale);
 	return [clamp(a), clamp(b)];
 }
-function clampDimensionsPreservingAspectRatio(sourceDimensions, desiredDimensions) {
-	const desiredAspectRatio = desiredDimensions.width / desiredDimensions.height;
-	let { width, height } = desiredDimensions;
-	if (sourceDimensions.width && width > sourceDimensions.width) {
-		width = sourceDimensions.width;
-		height = Math.round(sourceDimensions.width / desiredAspectRatio);
-	}
-	if (sourceDimensions.height && height > sourceDimensions.height) {
-		height = sourceDimensions.height;
-		width = Math.round(sourceDimensions.height * desiredAspectRatio);
-	}
-	return {
+function clampDimensionsPreservingAspectRatio(sourceDimensions, desiredDimensions, fit) {
+	const { width, height } = desiredDimensions;
+	const scales = [sourceDimensions.width ? width / sourceDimensions.width : void 0, sourceDimensions.height ? height / sourceDimensions.height : void 0].filter((scale) => scale !== void 0);
+	if (scales.length === 0) return {
 		width,
 		height
 	};
+	const scale = fit === "contain" ? Math.min(...scales) : Math.max(...scales);
+	if (scale <= 1) return {
+		width,
+		height
+	};
+	return {
+		width: Math.max(1, Math.round(width / scale)),
+		height: Math.max(1, Math.round(height / scale))
+	};
 }
 var handlers_exports = /* @__PURE__ */ __exportAll({
 	autoorient: () => autoorient,
@@ -330,9 +331,9 @@ const background = {
 	}
 };
 const enlarge = {
-	args: [],
-	apply: (context) => {
-		context.enlarge = true;
+	args: [VBoolean("enlarge")],
+	apply: (context, _pipe, enabled) => {
+		context.enlarge = enabled !== false;
 	}
 };
 const kernel = {
@@ -379,11 +380,13 @@ const resize = {
 	apply: (context, pipe, size) => {
 		if (!size) return;
 		let { width, height } = size;
-		if (!context.enlarge) {
+		const keepsSourceAspectRatio = context.fit === "inside" || context.fit === "outside";
+		const withoutEnlargement = !context.enlarge && keepsSourceAspectRatio;
+		if (!context.enlarge && !keepsSourceAspectRatio) {
 			const clamped = clampDimensionsPreservingAspectRatio(context.meta, {
 				width,
 				height
-			});
+			}, context.fit);
 			width = clamped.width;
 			height = clamped.height;
 		}
@@ -391,12 +394,16 @@ const resize = {
 			width,
 			height
 		});
-		context.outputDimensions = resizeOutputDimensions(capped, context.meta, { fit: context.fit });
+		context.outputDimensions = resizeOutputDimensions(capped, context.meta, {
+			fit: context.fit,
+			withoutEnlargement
+		});
 		return pipe.resize(capped.width, capped.height, {
 			fit: context.fit,
 			position: context.position,
 			background: context.background,
-			kernel: context.kernel
+			kernel: context.kernel,
+			withoutEnlargement
 		});
 	}
 };
@@ -832,13 +839,18 @@ const sanitizeSVGPlugin = {
 };
 function getEnv(name) {
 	const value = globalThis.process?.env?.[name];
-	if (value === void 0) return;
+	if (value === void 0 || value.trim() === "") return;
 	try {
 		return JSON.parse(value);
 	} catch {
 		return value;
 	}
 }
+function normalizeMaxAge(value) {
+	const n = typeof value === "string" && /^\d+$/.test(value) ? Number.parseInt(value, 10) : value;
+	if (typeof n !== "number" || !Number.isFinite(n) || n < 0) return;
+	return Math.min(Math.floor(n), 2 ** 31);
+}
 function getBuiltinModule(id) {
 	return globalThis.process?.getBuiltinModule?.(id);
 }
@@ -855,6 +867,25 @@ function cachedPromise(function_) {
 	};
 }
 const DEFAULT_MAX_OUTPUT_DIMENSION = 8192;
+const NON_HANDLER_MODIFIERS = /* @__PURE__ */ new Map([
+	["format", "format"],
+	["f", "format"],
+	["animated", "animated"],
+	["a", "animated"]
+]);
+function getModifierKey(name) {
+	return NON_HANDLER_MODIFIERS.get(name) ?? getHandler(name);
+}
+function resolveAllowedModifiers(names) {
+	if (names === void 0) return;
+	if (typeof names === "string") names = names.split(",").map((s) => s.trim()).filter(Boolean);
+	if (!Array.isArray(names)) throw new TypeError(`[ipx] allowedModifiers must be an array or a comma-separated string, got: ${JSON.stringify(names)}`);
+	return new Set(names.map((name) => {
+		const key = getModifierKey(name);
+		if (!key) throw new Error(`[ipx] Unknown modifier in allowedModifiers: ${name}`);
+		return key;
+	}));
+}
 const SUPPORTED_FORMATS = /* @__PURE__ */ new Set([
 	"jpeg",
 	"png",
@@ -869,13 +900,14 @@ function createIPX(userOptions) {
 	const options = {
 		...userOptions,
 		alias: userOptions.alias || getEnv("IPX_ALIAS") || {},
-		maxAge: userOptions.maxAge ?? getEnv("IPX_MAX_AGE") ?? 60,
+		maxAge: normalizeMaxAge(userOptions.maxAge) ?? normalizeMaxAge(getEnv("IPX_MAX_AGE")) ?? 60,
 		maxOutputDimension: userOptions.maxOutputDimension ?? getEnv("IPX_MAX_OUTPUT_DIMENSION") ?? DEFAULT_MAX_OUTPUT_DIMENSION,
 		sharpOptions: {
 			jpegProgressive: true,
 			...userOptions.sharpOptions
 		}
 	};
+	const allowedModifiers = resolveAllowedModifiers(userOptions.allowedModifiers ?? getEnv("IPX_ALLOWED_MODIFIERS"));
 	options.alias = Object.fromEntries(Object.entries(options.alias || {}).map((e) => [withLeadingSlash(e[0]), e[1]]));
 	const getSharp = cachedPromise(async () => {
 		return await import("sharp").then((r) => r.default || r);
@@ -890,6 +922,14 @@ function createIPX(userOptions) {
 			statusText: `IPX_MISSING_ID`,
 			message: `Resource id is missing`
 		});
+		modifiers = Object.assign(Object.create(null), modifiers);
+		if (allowedModifiers) {
+			for (const name of Object.keys(modifiers)) if (!allowedModifiers.has(getModifierKey(name))) throw new HTTPError({
+				statusCode: 400,
+				statusText: `IPX_FORBIDDEN_MODIFIER`,
+				message: `Modifier is not allowed: ${name}`
+			});
+		}
 		id = hasProtocol(id) ? id : withLeadingSlash(id);
 		for (const base in options.alias) if (id.startsWith(base)) id = joinURL(options.alias[base], id.slice(base.length));
 		const storage = hasProtocol(id) ? options.httpStorage || options.storage : options.storage || options.httpStorage;
@@ -905,9 +945,8 @@ function createIPX(userOptions) {
 				statusText: `IPX_RESOURCE_NOT_FOUND`,
 				message: `Resource not found: ${id}`
 			});
-			const _maxAge = sourceMeta.maxAge ?? options.maxAge;
 			return {
-				maxAge: typeof _maxAge === "string" ? Number.parseInt(_maxAge) : _maxAge,
+				maxAge: normalizeMaxAge(sourceMeta.maxAge) ?? options.maxAge,
 				mtime: sourceMeta.mtime ? new Date(sourceMeta.mtime) : void 0
 			};
 		});
@@ -977,11 +1016,14 @@ function createIPX(userOptions) {
 					...options.sharpOptions
 				});
 				Object.assign(sharp.options, options.sharpOptions);
-				const handlers = Object.entries(modifiers).map(([name, arguments_]) => ({
-					handler: getHandler(name),
-					name,
-					args: arguments_
-				})).filter((h) => h.handler).sort((a, b) => {
+				const handlers = Object.entries(modifiers).flatMap(([name, arguments_]) => {
+					const handler = getHandler(name);
+					return handler ? [{
+						handler,
+						name,
+						args: arguments_
+					}] : [];
+				}).sort((a, b) => {
 					const aOrder = a.handler.order || 0;
 					const bOrder = b.handler.order || 0;
 					return aOrder === bOrder ? (a.name || "").localeCompare(b.name || "") : aOrder - bOrder;
@@ -1028,8 +1070,11 @@ function createIPXNodeHandler(ipx, opts) {
 }
 function serveIPX(ipx, opts) {
 	const { serve } = requireModule("srvx");
-	const { parseURL, ...serverOptions } = opts || {};
-	const fetch = createIPXFetchHandler(ipx, { parseURL });
+	const { parseURL, autoFormats, ...serverOptions } = opts || {};
+	const fetch = createIPXFetchHandler(ipx, {
+		parseURL,
+		autoFormats
+	});
 	return serve({
 		...serverOptions,
 		fetch
@@ -1057,6 +1102,7 @@ function parseIPXURL(url) {
 }
 function createIPXHandler(ipx, opts = {}) {
 	const parseURL = opts.parseURL || parseIPXURL;
+	const autoFormats = resolveAutoFormats(opts.autoFormats || getEnv("IPX_AUTO_FORMATS"));
 	return defineEventHandler(async (event) => {
 		const parsed = await parseURL(event.req.url) || {};
 		const id = safeString(parsed.id);
@@ -1070,7 +1116,7 @@ function createIPXHandler(ipx, opts = {}) {
 		if ((modifiers.f || modifiers.format) === "auto") {
 			const acceptHeader = event.req.headers.get("accept") || "";
 			const animated = modifiers.animated ?? modifiers.a;
-			const autoFormat = autoDetectFormat(acceptHeader, !!animated || animated === "");
+			const autoFormat = autoDetectFormat(acceptHeader, autoFormats, !!animated || animated === "");
 			delete modifiers.f;
 			delete modifiers.format;
 			if (autoFormat) {
@@ -1135,17 +1181,32 @@ function etagMatches(ifNoneMatch, etag) {
 function opaqueTag(tag) {
 	return tag.startsWith("W/") ? tag.slice(2) : tag;
 }
-function autoDetectFormat(acceptHeader, animated) {
-	if (animated) return (0, import_accept_negotiator.negotiate)(acceptHeader, ["image/webp", "image/gif"])?.split("/")[1] || "gif";
-	return (0, import_accept_negotiator.negotiate)(acceptHeader, [
-		"image/avif",
-		"image/webp",
-		"image/jpeg",
-		"image/png",
-		"image/tiff",
-		"image/heif",
-		"image/gif"
-	])?.split("/")[1] || "jpeg";
+const DEFAULT_AUTO_FORMATS = [
+	"avif",
+	"webp",
+	"jpeg",
+	"png",
+	"tiff",
+	"heif",
+	"gif"
+];
+const ANIMATED_FORMATS = /* @__PURE__ */ new Set(["webp", "gif"]);
+function resolveAutoFormats(input) {
+	let list = [];
+	if (typeof input === "string") list = input.split(",");
+	else if (Array.isArray(input)) list = input;
+	const formats = list.map((f) => String(f ?? "").trim().toLowerCase()).filter(Boolean).map((f) => f === "jpg" ? "jpeg" : f);
+	const invalid = formats.filter((f) => !SUPPORTED_FORMATS.has(f));
+	if (invalid.length > 0) throw new TypeError(`[ipx] Unsupported \`autoFormats\`: ${invalid.join(", ")} (supported: ${[...SUPPORTED_FORMATS].join(", ")})`);
+	if (formats.length === 0) formats.push(...DEFAULT_AUTO_FORMATS);
+	return {
+		mimes: formats.map((f) => `image/${f}`),
+		animatedMimes: formats.filter((f) => ANIMATED_FORMATS.has(f)).map((f) => `image/${f}`)
+	};
+}
+function autoDetectFormat(acceptHeader, autoFormats, animated) {
+	if (animated) return (0, import_accept_negotiator.negotiate)(acceptHeader, autoFormats.animatedMimes)?.split("/")[1] || "gif";
+	return (0, import_accept_negotiator.negotiate)(acceptHeader, autoFormats.mimes)?.split("/")[1] || "jpeg";
 }
 function decode$1(input) {
 	try {
@@ -1246,10 +1307,28 @@ function decode(input) {
 		return input;
 	}
 }
+function parseCacheControlMaxAge(header) {
+	let start = 0;
+	let quoted = false;
+	for (let i = 0; i <= header.length; i++) {
+		const char = header[i];
+		if (quoted && char === "\\") {
+			i++;
+			continue;
+		}
+		if (char === "\"") quoted = !quoted;
+		if (!quoted && (char === "," || i === header.length)) {
+			const m = header.slice(start, i).trim().match(/^max-age=(?:"(\d+)"|(\d+))$/i);
+			const age = m?.[1] ?? m?.[2];
+			if (age !== void 0) return normalizeMaxAge(age);
+			start = i + 1;
+		}
+	}
+}
 function ipxHttpStorage(_options = {}) {
 	const allowAllDomains = _options.allowAllDomains ?? getEnv("IPX_HTTP_ALLOW_ALL_DOMAINS") ?? false;
 	let _domains = _options.domains || getEnv("IPX_HTTP_DOMAINS") || [];
-	const defaultMaxAge = _options.maxAge || getEnv("IPX_HTTP_MAX_AGE") || 300;
+	const defaultMaxAge = normalizeMaxAge(_options.maxAge) ?? normalizeMaxAge(getEnv("IPX_HTTP_MAX_AGE")) ?? 300;
 	const fetchOptions = _options.fetchOptions || getEnv("IPX_HTTP_FETCH_OPTIONS") || {};
 	const blockPrivateIPs = _options.blockPrivateIPs ?? getEnv("IPX_HTTP_BLOCK_PRIVATE_IPS") ?? false;
 	if (typeof _domains === "string") _domains = _domains.split(",").map((s) => s.trim());
@@ -1371,10 +1450,7 @@ function ipxHttpStorage(_options = {}) {
 		let maxAge = defaultMaxAge;
 		if (_options.ignoreCacheControl !== true) {
 			const _cacheControl = response.headers.get("cache-control");
-			if (_cacheControl) {
-				const m = _cacheControl.match(/max-age=(\d+)/);
-				if (m && m[1]) maxAge = Number.parseInt(m[1]);
-			}
+			if (_cacheControl) maxAge = parseCacheControlMaxAge(_cacheControl) ?? defaultMaxAge;
 		}
 		let mtime;
 		const _lastModified = response.headers.get("last-modified");
@@ -1422,7 +1498,7 @@ function ipxFSStorage(_options = {}) {
 	const fs = getBuiltinModule("node:fs/promises");
 	if (!fs) throw new Error("ipxFSStorage requires the `node:fs/promises` builtin, which this runtime does not provide");
 	const dirs = resolveDirs(_options.dir);
-	const maxAge = _options.maxAge ?? getEnv("IPX_FS_MAX_AGE");
+	const maxAge = normalizeMaxAge(_options.maxAge) ?? normalizeMaxAge(getEnv("IPX_FS_MAX_AGE"));
 	const allowSymlinksOutsideDir = _options.allowSymlinksOutsideDir ?? getEnv("IPX_FS_ALLOW_SYMLINKS_OUTSIDE_DIR") ?? false;
 	const realDirCache = [];
 	const getRealDir = (index, dir) => {

package/dist/_chunks/rolldown-runtime.mjs

@@ -5,14 +5,6 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res, err) => () => {
-	if (err) throw err[0];
-	try {
-		return fn && (res = fn(fn = 0)), res;
-	} catch (e) {
-		throw err = [e], e;
-	}
-};
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {
 	let target = {};
@@ -33,10 +25,9 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
-export { __commonJSMin, __esmMin, __exportAll, __require, __toCommonJS, __toESM };
+export { __commonJSMin, __exportAll, __require, __toESM };

package/dist/cli.mjs

@@ -2,7 +2,7 @@
 import { createIPX, ipxFSStorage, ipxHttpStorage, serveIPX } from "./_chunks/node-fs.mjs";
 import { parseArgs } from "node:util";
 var name = "ipx";
-var version = "4.0.0-beta.0";
+var version = "4.0.0";
 const { positionals, values } = parseArgs({
 	allowPositionals: true,
 	options: {
@@ -39,10 +39,11 @@ switch (command) {
 		process.exit(1);
 }
 async function runServe(args) {
-	await serveIPX(createIPX({
+	const ipx = createIPX({
 		storage: ipxFSStorage({ dir: args.dir ?? process.env.IPX_FS_DIR ?? process.cwd() }),
 		httpStorage: ipxHttpStorage({ domains: args.domains ?? process.env.IPX_HTTP_DOMAINS })
-	}), {
+	});
+	await serveIPX(ipx, {
 		port: Number(args.port ?? process.env.PORT ?? 3e3),
 		hostname: args.host ?? process.env.HOST ?? "0.0.0.0"
 	}).ready();

package/dist/index.d.mts

@@ -145,7 +145,7 @@ interface IPXModifiers {
   b: string;
   position: string;
   pos: string;
-  enlarge: FlagModifier;
+  enlarge: FlagModifier | false | "false";
   kernel: "nearest" | "cubic" | "mitchell" | "lanczos2" | "lanczos3" | (string & {});
   trim: number | string;
   extend: string;
@@ -234,6 +234,25 @@ type IPXOptions = {
    * @optional
    */
   maxOutputDimension?: number | false;
+  /**
+   * Modifiers that requests are allowed to use. Any other modifier (including
+   * an unknown one) is rejected with a `400` before the source is fetched.
+   *
+   * Every modifier is allowed by default. Restricting them to the ones a site
+   * actually uses (for example `["width", "height", "format", "quality"]`)
+   * shrinks the attack surface of the public endpoint: expensive operations
+   * such as `blur` or `median` cannot be triggered.
+   *
+   * Aliases follow their modifier: allowing `width` also allows `w`.
+   *
+   * Only modifier names are checked, not their values: allowing `format`
+   * allows every supported output format, including the slow-to-encode `avif`.
+   * The same image also stays reachable under many URLs (`?cb=1`, `w_10` vs
+   * `w_1e1`, ...), so this does not prevent busting a CDN cache.
+   *
+   * @optional
+   */
+  allowedModifiers?: (keyof IPXModifiers)[];
   /**
    * A mapping of URL aliases to their corresponding URLs, used to simplify resource identifiers.
    * @optional
@@ -283,7 +302,7 @@ type IPXOptions = {
  * @returns {IPX} An IPX processing function configured with the given options. See {@link IPX}.
  * @throws {Error} If critical options such as storage are missing or incorrectly configured.
  */
-declare function createIPX(userOptions: IPXOptions): IPX;
+export declare function createIPX(userOptions: IPXOptions): IPX;
 type FetchHandler = (request: Request | string | URL) => Response | Promise<Response>;
 interface IPXHandlerOptions {
   /**
@@ -303,10 +322,32 @@ interface IPXHandlerOptions {
    * @optional
    */
   parseURL?: IPXURLParser;
+  /**
+   * Output formats `f_auto` can pick from, in order of preference.
+   *
+   * Useful to leave out formats that are slow to encode, such as `avif`.
+   *
+   * The format the client's `Accept` header lists with the highest q-value wins,
+   * and equal q-values go to the earlier entry. Wildcards such as `image/*` do
+   * not match a format, so browsers only negotiate the formats they list
+   * explicitly (in practice `avif`, `webp` and `png`).
+   *
+   * Animated images only consider `webp` and `gif` from this list. When nothing
+   * matches, `jpeg` (or `gif` for animated images) is used.
+   *
+   * Unknown formats throw when the handler is created.
+   *
+   * Can also be set with the `IPX_AUTO_FORMATS` environment variable (JSON array
+   * or comma separated list).
+   *
+   * @default ["avif", "webp", "jpeg", "png", "tiff", "heif", "gif"]
+   */
+  autoFormats?: IPXAutoFormat[];
 }
-declare function createIPXFetchHandler(ipx: IPX, opts?: IPXHandlerOptions): FetchHandler;
-declare function createIPXNodeHandler(ipx: IPX, opts?: IPXHandlerOptions): NodeHttpHandler;
-declare function serveIPX(ipx: IPX, opts?: Omit<ServerOptions, "fetch"> & IPXHandlerOptions): Server;
+type IPXAutoFormat = "avif" | "webp" | "jpeg" | "jpg" | "png" | "tiff" | "heif" | "heic" | "gif";
+export declare function createIPXFetchHandler(ipx: IPX, opts?: IPXHandlerOptions): FetchHandler;
+export declare function createIPXNodeHandler(ipx: IPX, opts?: IPXHandlerOptions): NodeHttpHandler;
+export declare function serveIPX(ipx: IPX, opts?: Omit<ServerOptions, "fetch"> & IPXHandlerOptions): Server;
 interface IPXParsedURL {
   /**
    * The identifier of the source image (path or URL, depending on the storage).
@@ -330,7 +371,7 @@ type IPXURLParser = (url: string) => IPXParsedURL | Promise<IPXParsedURL>;
  * @returns {IPXParsedURL} The parsed resource id and modifiers. See {@link IPXParsedURL}.
  * @throws {HTTPError} If the modifiers segment is missing.
  */
-declare function parseIPXURL(url: string): IPXParsedURL;
+export declare function parseIPXURL(url: string): IPXParsedURL;
 type HTTPStorageOptions = {
   /**
    * Custom options for fetch operations, such as headers or method overrides.
@@ -345,7 +386,13 @@ type HTTPStorageOptions = {
    */
   fetchOptions?: RequestInit;
   /**
-   * Default maximum age (in seconds) for cache control. If not specified, defaults to the environment setting or 300 seconds.
+   * Fallback `cache-control` max-age (in seconds), used when the upstream response has no
+   * `max-age` directive or {@link HTTPStorageOptions.ignoreCacheControl} is set. If not
+   * specified, defaults to `IPX_HTTP_MAX_AGE` or 300 seconds.
+   *
+   * `0` is kept rather than replaced by the default: caches may still store the response but
+   * must revalidate it on every request. It does not override an upstream `max-age` unless
+   * `ignoreCacheControl` is set. Invalid values (negative, `NaN`, non-numeric) count as unset.
    * @optional
    */
   maxAge?: number;
@@ -379,6 +426,12 @@ type HTTPStorageOptions = {
    * (`169.254.169.254`, the cloud metadata service), RFC1918, CGNAT, unique-local or
    * otherwise non-public space.
    *
+   * Best effort: it does not protect against DNS rebinding. The hostname is validated, then
+   * resolved again when the socket is opened, so an attacker-controlled record with a short
+   * TTL can answer with a public address first and a private one second. When IPX must not
+   * reach internal services, enforce that at the network level (egress proxy, firewall or
+   * network policy) instead of relying on this option alone.
+   *
    * Disabled by default because many legitimate deployments fetch from in-cluster origins
    * (internal object storage, sidecars, `localhost` during development), which this blocks.
    * @optional
@@ -394,7 +447,7 @@ type HTTPStorageOptions = {
  * @returns {IPXStorage} An IPXStorage interface implementation for retrieving images over HTTP. See {@link IPXStorage}.
  * @throws {H3Error} If validation of the requested URL fails due to a missing hostname or denied host access. See {@link H3Error}.
  */
-declare function ipxHttpStorage(_options?: HTTPStorageOptions): IPXStorage;
+export declare function ipxHttpStorage(_options?: HTTPStorageOptions): IPXStorage;
 type NodeFSSOptions = {
   /**
    * The directory or list of directories from which to serve files. If not specified, the current directory is used by default.
@@ -437,7 +490,7 @@ type NodeFSSOptions = {
  * @returns {IPXStorage} An implementation of the IPXStorage interface for accessing images stored on the local file system. See {@link IPXStorage}.
  * @throws {H3Error} If there is a problem accessing the file system module or resolving/reading files. See {@link H3Error}.
  */
-declare function ipxFSStorage(_options?: NodeFSSOptions): IPXStorage;
+export declare function ipxFSStorage(_options?: NodeFSSOptions): IPXStorage;
 type UnstorageIPXStorageOptions = {
   /**
    * Optional prefix to be placed in front of each storage key, which can help to name or categorise stored items.
@@ -454,5 +507,5 @@ type UnstorageIPXStorageOptions = {
  * @returns {IPXStorage}. An IPXStorage compliant object that implements the necessary methods to interact with the provided unstorage driver or storage system. See {@link IPXStorage}.
  * @throws {H3Error} If there is a problem retrieving or converting the storage data, detailed error information is thrown. See {@link H3Error}.
  */
-declare function unstorageToIPXStorage(storage: Storage | Driver, _options?: UnstorageIPXStorageOptions | string): IPXStorage;
-export { HTTPError, type HTTPStorageOptions, type Handler, type HandlerContext, type IPX, type IPXHandlerOptions, type IPXModifiers, type IPXOptions, type IPXParsedURL, type IPXStorage, type IPXStorageMeta, type IPXStorageOptions, type IPXURLParser, type NodeFSSOptions, type UnstorageIPXStorageOptions, createIPX, createIPXFetchHandler, createIPXNodeHandler, ipxFSStorage, ipxHttpStorage, parseIPXURL, serveIPX, unstorageToIPXStorage };
+export declare function unstorageToIPXStorage(storage: Storage | Driver, _options?: UnstorageIPXStorageOptions | string): IPXStorage;
+export { HTTPError, type HTTPStorageOptions, type Handler, type HandlerContext, type IPX, type IPXAutoFormat, type IPXHandlerOptions, type IPXModifiers, type IPXOptions, type IPXParsedURL, type IPXStorage, type IPXStorageMeta, type IPXStorageOptions, type IPXURLParser, type NodeFSSOptions, type UnstorageIPXStorageOptions };

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "ipx",
-  "version": "4.0.0-beta.1",
+  "version": "4.0.0",
   "description": "High performance, secure and easy-to-use image optimizer.",
-  "repository": "unjs/ipx",
+  "repository": {
+    "type": "git",
+    "url": "unjs/ipx"
+  },
   "license": "MIT",
   "sideEffects": false,
   "type": "module",
@@ -17,42 +20,30 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "obuild",
-    "gen:operations": "node ./scripts/gen-operations.ts",
-    "ipx": "node ./src/cli.ts",
-    "lint": "eslint . && prettier -c src test scripts automd.config.ts",
-    "lint:fix": "automd && eslint . --fix && prettier -w src test scripts automd.config.ts",
-    "prepack": "pnpm build",
-    "release": "pnpm test && pnpm build && changelogen --release --prerelease --push && npm publish --tag latest",
-    "start": "node bin/ipx.js",
-    "test": "pnpm lint && pnpm test:types && vitest run --coverage",
-    "test:types": "tsc --noEmit"
-  },
   "dependencies": {
-    "sharp": "^0.35.3",
-    "srvx": "^0.12.4"
+    "sharp": "^0.35.5",
+    "srvx": "^1.0.5"
   },
   "devDependencies": {
-    "@fastify/accept-negotiator": "^2.0.1",
+    "@fastify/accept-negotiator": "^2.1.1",
     "@types/etag": "^1.8.4",
     "@types/is-valid-path": "^0.1.2",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^5.0.3",
     "automd": "^0.4.3",
     "changelogen": "^0.6.2",
-    "eslint": "^10.8.0",
+    "eslint": "^10.12.0",
     "eslint-config-unjs": "^0.6.2",
     "etag": "^1.8.1",
-    "h3": "2.0.1-rc.26",
-    "image-meta": "^0.2.2",
-    "obuild": "^0.4.38",
-    "oxc-minify": ">=0.141.0",
-    "prettier": "^3.9.6",
-    "svgo": "^4.0.2",
-    "typescript": "^6",
+    "h3": "^2.0.2",
+    "image-meta": "^0.3.0",
+    "obuild": "^0.4.44",
+    "oxc-minify": ">=0.153.0",
+    "prettier": "^3.9.10",
+    "svgo": "^4.1.0",
+    "typescript": "^6.0.3",
     "ufo": "^1.6.4",
     "unstorage": "^1.17.5",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.3"
   },
   "peerDependencies": {
     "unstorage": "*"
@@ -65,5 +56,15 @@
   "engines": {
     "node": "^20.16.0 || >=22.3.0"
   },
-  "packageManager": "pnpm@11.17.0"
-}
+  "scripts": {
+    "build": "obuild",
+    "gen:operations": "node ./scripts/gen-operations.ts",
+    "ipx": "node ./src/cli.ts",
+    "lint": "eslint . && prettier -c src test scripts automd.config.ts",
+    "lint:fix": "automd && eslint . --fix && prettier -w src test scripts automd.config.ts",
+    "release": "pnpm test && pnpm build && changelogen --release --push && pnpm publish --tag latest",
+    "start": "node bin/ipx.js",
+    "test": "pnpm lint && pnpm test:types && vitest run --coverage",
+    "test:types": "tsc --noEmit"
+  }
+}